From: Greg Kroah-Hartman Date: Mon, 5 Jun 2023 16:54:05 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.14.317~68 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1e5d276957edb5275fe705efb73b75e43d083f33;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: x86-boot-wrap-literal-addresses-in-absolute_pointer.patch --- diff --git a/queue-5.4/series b/queue-5.4/series index 2f9716d0e39..0fc9be4dcab 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -71,3 +71,4 @@ misc-fastrpc-reject-new-invocations-during-device-removal.patch scsi-stex-fix-gcc-13-warnings.patch ata-libata-scsi-use-correct-device-no-in-ata_find_dev.patch flow_dissector-work-around-stack-frame-size-warning.patch +x86-boot-wrap-literal-addresses-in-absolute_pointer.patch diff --git a/queue-5.4/x86-boot-wrap-literal-addresses-in-absolute_pointer.patch b/queue-5.4/x86-boot-wrap-literal-addresses-in-absolute_pointer.patch new file mode 100644 index 00000000000..d2d3b40bc15 --- /dev/null +++ b/queue-5.4/x86-boot-wrap-literal-addresses-in-absolute_pointer.patch @@ -0,0 +1,141 @@ +From aeb84412037b89e06f45e382f044da6f200e12f8 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Sun, 27 Feb 2022 11:59:18 -0800 +Subject: x86/boot: Wrap literal addresses in absolute_pointer() + +From: Kees Cook + +commit aeb84412037b89e06f45e382f044da6f200e12f8 upstream. + +GCC 11 (incorrectly[1]) assumes that literal values cast to (void *) +should be treated like a NULL pointer with an offset, and raises +diagnostics when doing bounds checking under -Warray-bounds. GCC 12 +got "smarter" about finding these: + + In function 'rdfs8', + inlined from 'vga_recalc_vertical' at /srv/code/arch/x86/boot/video-mode.c:124:29, + inlined from 'set_mode' at /srv/code/arch/x86/boot/video-mode.c:163:3: + /srv/code/arch/x86/boot/boot.h:114:9: warning: array subscript 0 is outside array bounds of 'u8[0]' {aka 'unsigned char[]'} [-Warray-bounds] + 114 | asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr)); + | ^~~ + +This has been solved in other places[2] already by using the recently +added absolute_pointer() macro. Do the same here. + + [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578 + [2] https://lore.kernel.org/all/20210912160149.2227137-1-linux@roeck-us.net/ + +Signed-off-by: Kees Cook +Signed-off-by: Borislav Petkov +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20220227195918.705219-1-keescook@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/boot/boot.h | 36 ++++++++++++++++++++++++------------ + arch/x86/boot/main.c | 2 +- + 2 files changed, 25 insertions(+), 13 deletions(-) + +--- a/arch/x86/boot/boot.h ++++ b/arch/x86/boot/boot.h +@@ -110,66 +110,78 @@ typedef unsigned int addr_t; + + static inline u8 rdfs8(addr_t addr) + { ++ u8 *ptr = (u8 *)absolute_pointer(addr); + u8 v; +- asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr)); ++ asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*ptr)); + return v; + } + static inline u16 rdfs16(addr_t addr) + { ++ u16 *ptr = (u16 *)absolute_pointer(addr); + u16 v; +- asm volatile("movw %%fs:%1,%0" : "=r" (v) : "m" (*(u16 *)addr)); ++ asm volatile("movw %%fs:%1,%0" : "=r" (v) : "m" (*ptr)); + return v; + } + static inline u32 rdfs32(addr_t addr) + { ++ u32 *ptr = (u32 *)absolute_pointer(addr); + u32 v; +- asm volatile("movl %%fs:%1,%0" : "=r" (v) : "m" (*(u32 *)addr)); ++ asm volatile("movl %%fs:%1,%0" : "=r" (v) : "m" (*ptr)); + return v; + } + + static inline void wrfs8(u8 v, addr_t addr) + { +- asm volatile("movb %1,%%fs:%0" : "+m" (*(u8 *)addr) : "qi" (v)); ++ u8 *ptr = (u8 *)absolute_pointer(addr); ++ asm volatile("movb %1,%%fs:%0" : "+m" (*ptr) : "qi" (v)); + } + static inline void wrfs16(u16 v, addr_t addr) + { +- asm volatile("movw %1,%%fs:%0" : "+m" (*(u16 *)addr) : "ri" (v)); ++ u16 *ptr = (u16 *)absolute_pointer(addr); ++ asm volatile("movw %1,%%fs:%0" : "+m" (*ptr) : "ri" (v)); + } + static inline void wrfs32(u32 v, addr_t addr) + { +- asm volatile("movl %1,%%fs:%0" : "+m" (*(u32 *)addr) : "ri" (v)); ++ u32 *ptr = (u32 *)absolute_pointer(addr); ++ asm volatile("movl %1,%%fs:%0" : "+m" (*ptr) : "ri" (v)); + } + + static inline u8 rdgs8(addr_t addr) + { ++ u8 *ptr = (u8 *)absolute_pointer(addr); + u8 v; +- asm volatile("movb %%gs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr)); ++ asm volatile("movb %%gs:%1,%0" : "=q" (v) : "m" (*ptr)); + return v; + } + static inline u16 rdgs16(addr_t addr) + { ++ u16 *ptr = (u16 *)absolute_pointer(addr); + u16 v; +- asm volatile("movw %%gs:%1,%0" : "=r" (v) : "m" (*(u16 *)addr)); ++ asm volatile("movw %%gs:%1,%0" : "=r" (v) : "m" (*ptr)); + return v; + } + static inline u32 rdgs32(addr_t addr) + { ++ u32 *ptr = (u32 *)absolute_pointer(addr); + u32 v; +- asm volatile("movl %%gs:%1,%0" : "=r" (v) : "m" (*(u32 *)addr)); ++ asm volatile("movl %%gs:%1,%0" : "=r" (v) : "m" (*ptr)); + return v; + } + + static inline void wrgs8(u8 v, addr_t addr) + { +- asm volatile("movb %1,%%gs:%0" : "+m" (*(u8 *)addr) : "qi" (v)); ++ u8 *ptr = (u8 *)absolute_pointer(addr); ++ asm volatile("movb %1,%%gs:%0" : "+m" (*ptr) : "qi" (v)); + } + static inline void wrgs16(u16 v, addr_t addr) + { +- asm volatile("movw %1,%%gs:%0" : "+m" (*(u16 *)addr) : "ri" (v)); ++ u16 *ptr = (u16 *)absolute_pointer(addr); ++ asm volatile("movw %1,%%gs:%0" : "+m" (*ptr) : "ri" (v)); + } + static inline void wrgs32(u32 v, addr_t addr) + { +- asm volatile("movl %1,%%gs:%0" : "+m" (*(u32 *)addr) : "ri" (v)); ++ u32 *ptr = (u32 *)absolute_pointer(addr); ++ asm volatile("movl %1,%%gs:%0" : "+m" (*ptr) : "ri" (v)); + } + + /* Note: these only return true/false, not a signed return value! */ +--- a/arch/x86/boot/main.c ++++ b/arch/x86/boot/main.c +@@ -33,7 +33,7 @@ static void copy_boot_params(void) + u16 cl_offset; + }; + const struct old_cmdline * const oldcmd = +- (const struct old_cmdline *)OLD_CL_ADDRESS; ++ absolute_pointer(OLD_CL_ADDRESS); + + BUILD_BUG_ON(sizeof(boot_params) != 4096); + memcpy(&boot_params.hdr, &hdr, sizeof(hdr));